HIPAA-Compliant CRM: A Solo Agent's Pre-Sign Checklist

Four things make a CRM HIPAA compliant, and a vendor needs all four. Here is how to verify any vendor in about 15 minutes before you sign, plus the exit questions most agents forget.

Key takeaways

• A CRM is only HIPAA compliant when it signs a BAA, encrypts PHI at rest and in transit, restricts access by role, and keeps audit logs you can pull on demand.
• Storing Medicare IDs, plan enrollments, or health notes in a CRM without a BAA is a violation, not a gray area, even for a one-person agency.
• Zoho CRM offers HIPAA settings on its paid editions and a BAA on request, but you configure it yourself, so get the signed BAA before storing PHI.
• Before signing, get written answers on BAA timing, encryption standards, audit logs, breach notification, and full CSV export with no extra fee.
• Switch CRMs in a quiet month, run both systems in parallel for two weeks, and confirm texting number ownership before the cutover.

A HIPAA-compliant CRM is one that signs a BAA, encrypts PHI at rest and in transit, restricts access by role, and keeps audit logs you can pull on demand. Most vendors claim all four; few prove it on their sales page. This guide gives you the checklist to verify either way in about 15 minutes.

What makes a CRM HIPAA compliant (and what vendors won't tell you)?

Four things, and a vendor needs all four: a signed BAA, encryption at rest and in transit, access controls, and audit logs. Miss one and "HIPAA compliant" on the sales page is just marketing.

The BAA is the floor, not the ceiling

A Business Associate Agreement is a contract where the vendor accepts legal responsibility for your clients' PHI. Without one, storing Medicare numbers or health details in a CRM means you're the only one on the hook. HHS publishes the official guidance on business associate agreements, and any vendor who hesitates to sign one has answered your question. But a BAA alone doesn't make software compliant; it just makes the vendor legally liable.

Encryption, access controls, and audit logs

Encryption protects PHI in the database and when it moves. Access controls let you decide which user sees which client. Audit logs record who viewed or changed a record and when. Ask each vendor to demonstrate all three.

'HIPAA ready' vs 'HIPAA compliant'

"HIPAA ready" often means "we'll sign a BAA" and nothing more. The same test applies to any tool touching PHI, including call recording setups.

Do you need a HIPAA-compliant CRM, or is your data out of scope?

If you store client names with health conditions, plan choices, Medicare IDs, or Scope of Appointment details, you are handling PHI and need a CRM that will sign a BAA. A solo agent is a covered entity's business associate in practice, and "it's just my spreadsheet" does not put the data out of scope.

What counts as PHI in an insurance book of business

PHI is any health-related detail tied to an identifiable client. In your book that means turning-65 dates, plan enrollments, commission records tied to policies, doctor or prescription notes, and even a client study showing diabetes or heart failure. A generic CRM holding names, emails, and policy numbers alongside that context is holding PHI.

When a generic CRM crosses the line

The line is crossed the moment health information lands in a system with no BAA in place. Notes like "client on insulin, check Part D options" typed into a non-compliant CRM are a violation, not a gray area. The same applies to referral tracking: our referral program compliance checklist covers why referral records that mention health status need the same protection.

Is Zoho CRM HIPAA compliant?

Short answer: it can be, on a paid edition, once Zoho's BAA is signed and its HIPAA settings are switched on. Zoho's edition comparison lists HIPAA Compliance Settings on the Standard, Professional, Enterprise and Ultimate editions, not on the Free edition, and Zoho sends its BAA template on request through legal@zohocorp.com. If you store client names, dates of birth, or Medicare numbers in Zoho CRM before that BAA is signed, you are handling PHI without a BAA, and that is a compliance gap regardless of how careful you are personally.

What Zoho says about HIPAA

Zoho's help center says Zoho CRM "provides features to help its customers use CRM within the premises of HIPAA compliance." The setup is yours to do: you choose up to 10 modules that hold health data, mark up to 25 fields per module as personal health data, and decide whether to block those fields from API access and export. HIPAA is supported for Leads, Contacts, Vendors, and custom modules, and the audit log is kept for 60 days by default unless you export it. Confirm in writing which service your BAA covers. A sales chat is not a BAA.

What the BAA requirement means for your plan

Without a BAA, a breach involving client data triggers your own notification duties under the HHS Breach Notification Rule. That is why the BAA checklist matters more than the feature list. Before committing to any generic CRM, run it through the policy delivery and compliance checklist mindset: contract first, features second.

What should be on your BAA and security checklist before signing?

Nine questions to run against any vendor's sales page

A BAA is not a feature, it is a contract, and a vendor who will not sign one before you pay is telling you something. Before you commit to any CRM, including ours, get written answers to these:

1. Will you sign a BAA before the trial starts, not after?
2. Is PHI encrypted at rest and in transit? Ask for AES-256 at rest and TLS 1.2+ in transit, in writing.
3. Who can see client records, and can you restrict a downline or a contracted sub-agent to their own book?
4. Is there an audit log showing who opened or edited a client record, and when?
5. How are you notified of a breach, and within what timeframe?
6. Where is data hosted, and is backup encrypted too?
7. Do texting and email live inside the BAA, or in a separate tool that does not?
8. Can you set automatic logoff and password rules yourself?
9. Is Scope of Appointment and consent documentation stored with the client record, not in a folder on your desktop?

If a sales rep answers "yes" to everything but cannot put it in writing, treat that as a no.

The exit clause most agents forget

The checklist people skip is the one that matters when you leave. Ask three exit questions before signing: can you export every client record, note, document and commission entry in a usable format like CSV, at no extra fee; can you delete your data on request and get written confirmation; and does anything you rely on daily, like your texting number, belong to you or to the vendor? The Insurance Forums thread about leaving AgencyBloc shows how painful this gets when the texting line is tied to the platform. Run the same exit test on AgencyView: you can download every client and policy as a CSV from your account at any time, even while the account is paused, but our texting is provisioned through the platform, so ask us the ownership question directly before you sign. For the compliance side of what you post publicly, see our social media compliance checklist for Medicare agents.

How do healthcare CRMs differ from generic CRMs with a BAA?

A BAA covers the legal side: encryption, access controls, audit logs, breach notification. Zoho's own documentation makes clear you configure Zoho CRM for HIPAA yourself and sign the BAA before storing PHI (Zoho HIPAA compliance). What the BAA does not give you is workflows. A generic CRM has no idea what a Scope of Appointment is, when AEP starts, or that a client turning 65 has a seven-month initial enrollment window.

What a BAA does not give you: workflows

You end up building the insurance side by hand: custom fields for SOA dates, spreadsheet tabs for commissions, calendar reminders for AEP follow-ups. That works until a missing payment or a chargeback slips through because nothing was tracking it. The same discipline applies to license and appointment deadlines, which is why we keep a separate multi-state license tracking guide for agents juggling state renewals.

Where an AMS/CRM built for agents fits

Platforms built for agents, such as AgencyBloc, Medicare Pro, NextAgency and our own AgencyView, are designed around those workflows: SOA tracking, enrollment statuses, commission reconciliation, compliance logs. Coverage varies by product and plan, so check each one in a demo. The honest tradeoff: a generic CRM with a BAA is often cheaper and more flexible, and it wins if your book is tiny and your processes are simple. An agent-built AMS earns its price when quoting, commissions and AEP deadlines live in one screen instead of four tabs.

Which HIPAA-compliant CRM software fits a small business budget?

For a one-seat agency, per-seat pricing is the whole math. One solo agent weighing a move off an incumbent AMS put the savings at "almost a hundred a month", about $1,200 a year, much of it for features most solo agents never open. The realistic options for a small Medicare or ACA book:

Comparing the options for a one-seat agency

Where AgencyView falls short and fits

Honest limits: AgencyView is built for health, Medicare and ACA books, so a mixed line of business is outside its core. It has fewer integrations and a smaller ecosystem than AgencyBloc, and there is no marketplace of third-party add-ons. Built-in quoting covers ACA and final expense plans; Medicare Advantage enrollment still happens in the carrier and enrollment tools you already use.

Where it fits: a solo agent who wants HIPAA safeguards, commission tracking and client records in one screen instead of four tabs. If your Medicare book is small and manageable, the switch cost is low.

What questions should you ask a CRM vendor about PHI handling?

Email these before you sign, and keep the answers in writing:

1. Will you sign a BAA before I enter any client data, and is it included in my tier or an add-on?
2. Which tier includes HIPAA features? Vendors gate this: Zoho, for example, leaves its HIPAA settings off the Free edition, so check the tier table on their pricing page rather than trusting a sales rep's summary.
3. Where are audit logs, and can I export them?
4. Who can see a client record, and can I lock that down per user?
5. Is data encrypted at rest and in transit?
6. If I cancel, how do I export everything, including notes and documents?

A vendor that answers all six in one email is ready for a solo agent. One that hedges on the BAA question is not.

How do you switch CRMs without losing your texting line or your notes?

What to ask about data import

Ask the vendor to confirm in writing that they can import everything from your current system: notes, documents, emails, and client history. Get a sample import done on a few test clients before you commit. Also ask who owns your texting number and whether it can be ported. If your texting line runs through your current CRM's provider, it may not travel with you, and a number printed on all your business materials is worth protecting before you sign anything.

Timing the switch before AEP

A small, manageable Medicare book can absorb a mid-year switch; an AEP-season migration cannot. Pick a quiet month, run both systems in parallel for two weeks, and finish the cutover well before Scope of Appointment season starts. Ask about contract end dates and renewal increases on your current plan first, so the switch lands between terms rather than mid-commitment.

FAQ

Can I export my client data if I leave a HIPAA-compliant CRM?

Ask before signing, not after. Get written confirmation that every client record, note, document, and commission entry exports in a usable format like CSV at no extra fee. Also ask who owns your texting number, since lines provisioned through the platform may not travel with you, and confirm the vendor deletes your data on request with written confirmation.

Does signing a BAA automatically make a CRM HIPAA compliant?

No. A BAA only makes the vendor legally liable for your clients' PHI; it is the floor, not the ceiling. Compliance also requires encryption at rest and in transit, role-based access controls, and audit logs you can pull on demand. A vendor who hesitates to sign a BAA has answered your question, but one who signs it has not proven the other three.

What counts as PHI in a solo agent's book of business?

Any health-related detail tied to an identifiable client: Medicare IDs, turning-65 dates, plan enrollments, Scope of Appointment records, prescription or doctor notes, and commission records tied to policies. Notes like "client on insulin, check Part D options" typed into a CRM without a BAA are a violation, not a gray area, even in a spreadsheet or a one-person shop.

Is a generic CRM with a BAA enough for a Medicare agent?

It covers the legal side: encryption, access controls, audit logs, breach notification. What it does not give you is workflows. You will build SOA date fields, commission tabs, and AEP reminders by hand, and things slip through. A generic CRM wins if your book is tiny and processes are simple; an agent-built AMS earns its price when quoting, commissions, and deadlines live in one screen.

When should I switch CRMs relative to AEP?

A small, manageable Medicare book can absorb a mid-year switch; an AEP-season migration cannot. Pick a quiet month, run both systems in parallel for two weeks, and finish the cutover well before Scope of Appointment season starts. Check your current contract's end date and renewal increase first so the switch lands between terms rather than mid-commitment.

Cover photo: Ron Lach / Pexels

Where AgencyView fits

• CRM with HIPAA compliance tools

Keep reading

• HIPAA Compliant Call Recording for Insurance Agents
• HIPAA Basics for Insurance Agencies: What a BAA Covers
• Choosing an Insurance Agency CRM: The Evaluation Checklist

Share: Facebook · LinkedIn · X · Email

All articles · AgencyView